Notepad++ EUVD-2026-39903

Exploitation requires that the victim be running Notepad++ 8.9.6.1 on Windows and invoke the Run command (the feature that calls ShellExecute() via Command::run()) against a path that the attacker can influence - for example through a crafted session/configuration or a document-supplied command string. The specific precondition is a path that begins with a legitimate trusted-directory prefix but embeds ..\..\ traversal so it passes the non-canonicalizing PathIsPrefix-style check while resolving elsewhere. Limiting factors: the attack is local (AV:L) and demands user interaction (UI:R) to trigger the Run action, the executable must already be placed at the traversal-resolved location, and only the unpatched 8.9.6.1 release is vulnerable - versions at or above 8.9.6.2 canonicalize first and are not affected.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local attack vector, low complexity, no privileges, but mandatory user interaction, yielding full confidentiality/integrity/availability impact in the user's security context. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure appears low-to-moderate: this is a UI-gated, local-vector bug rather than a remotely automatable one. The dependency on user interaction (a user must trigger the Run command on attacker-influenced content, e.g., a session/config or document that supplies the malicious path) is the principal limiting factor and argues against treating it as an emergency despite the High score. It is also notable that this is a bypass of an earlier security control (CVE-2026-48800), so environments that believed they were protected by 8.9.6.x are not until 8.9.6.2 - worth prioritizing in patch cycles but not a drop-everything item absent evidence of active exploitation.

An attacker delivers a Notepad++ session, configuration, or document that causes the Run command to receive a path like <trusted-dir>\..\..\Users\Public\evil.exe; the prefix-based isInTrustedDirectory() check accepts it, but ShellExecute() resolves the traversal and launches the attacker's binary in the victim's context. The local, low-complexity vector means execution is reliable once the victim triggers the Run action, though the required user interaction (UI:R) means the attacker must lure the user into that step; no public POC was provided.